Hetvi Thakar
ba7e6744c6
libssh2: Fix CVE-2026-58051
...
Backport the upstream fix for CVE-2026-58051 using the
commit in [1].
The CVE advisory [2] describes an uninitialized
publickey-list entry cleanup issue affecting libssh2
through 1.11.1.
[1] https://github.com/libssh2/libssh2/commit/a9758da45a52bc8c630ec9493804d0c6ea30b24a
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-58051
(From OE-Core rev: 19c481ffd3824512eb85845f04ae7b08b947b4f6)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com >
Signed-off-by: Yoann Congal <yoann.congal@smile.fr >
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org >
2026-09-11 14:32:08 +01:00
Adarsh Jagadish Kamini
8cf593c04e
libssh2: fix CVE-2026-58050
...
Backport patch to fix CVE-2026-58050.
References:
https://nvd.nist.gov/vuln/detail/CVE-2026-58050
Upstream fix:
https://github.com/libssh2/libssh2/commit/34497525929b9a47f03dfb81887ac896202b7e12
(From OE-Core rev: 4b86de3333748d41785365fc62f6afabb454b62b)
Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech >
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr >
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org >
2026-08-28 09:52:24 +01:00
Jaipaul Cheernam
b28d0cf59a
libssh2: fix CVE-2026-66035
...
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-66035
https://github.com/libssh2/libssh2/commit/42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4
libssh2 ptest results (qemux86-64):
before: PASSED: 1 FAILED: 0 SKIPPED: 0
after: PASSED: 1 FAILED: 0 SKIPPED: 0
(From OE-Core rev: e0e829a80e9d8a736c41594c0fe7d4fddca9f0b4)
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech >
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr >
Signed-off-by: Paul Barker <paul@pbarker.dev >
2026-08-24 11:43:46 +01:00
Jaipaul Cheernam
001428f528
libssh2: fix CVE-2026-66034
...
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-66034
https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99804cd898d9
libssh2 ptest results (qemux86-64):
before: PASSED: 1 FAILED: 0 SKIPPED: 0
after: PASSED: 1 FAILED: 0 SKIPPED: 0
(From OE-Core rev: 677c476980e7ef47bc4804682c554796edd0cde8)
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech >
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr >
Signed-off-by: Paul Barker <paul@pbarker.dev >
2026-08-24 11:43:46 +01:00
Jaipaul Cheernam
69957c8adf
libssh2: fix CVE-2026-66033
...
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-66033
https://github.com/libssh2/libssh2/commit/a2ed82d40964bbc0d64cd717aa0a5a892117d2e6
libssh2 ptest results (qemux86-64):
before: PASSED: 1 FAILED: 0 SKIPPED: 0
after: PASSED: 1 FAILED: 0 SKIPPED: 0
(From OE-Core rev: bd8afadd38a27c0e143cf7b0096c2abded569f82)
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech >
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr >
Signed-off-by: Paul Barker <paul@pbarker.dev >
2026-08-24 11:43:46 +01:00
Jaipaul Cheernam
23aeeb9e5d
libssh2: fix CVE-2026-66032
...
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-66032
https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0
libssh2 ptest results (qemux86-64):
before: PASSED: 1 FAILED: 0 SKIPPED: 0
after: PASSED: 1 FAILED: 0 SKIPPED: 0
(From OE-Core rev: c578c63b01b919bc403b9fb27bd76a2ccc632d3c)
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech >
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr >
Signed-off-by: Paul Barker <paul@pbarker.dev >
2026-08-24 11:43:46 +01:00
David Nyström
c38773f228
libssh2: Fix CVE-2025-15661
...
Fix CVE-2025-15661[1] similiar to debian[2], two first commits identical,
third commit fixes a return code regression introduced by CVE fix commit.
[1] https://nvd.nist.gov/vuln/detail/CVE-2025-15661
[2] https://sources.debian.org/patches/libssh2/1.11.1-4/
(From OE-Core rev: bfe549a53dc12382745fc49d37f3d2709fc20bec)
Signed-off-by: David Nyström <david.nystrom@est.tech >
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr >
Signed-off-by: Paul Barker <paul@pbarker.dev >
2026-08-24 11:43:45 +01:00
Daniel Turull
c70d4a799a
libssh2: fix CVE-2026-55199
...
Backport patch to fix CVE-2026-55199.
https://nvd.nist.gov/vuln/detail/CVE-2026-55199
Upstream fix:
https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4
Tested with ptest:
Before: PASSED: 3, FAILED: 0, SKIPPED: 0
After: PASSED: 3, FAILED: 0, SKIPPED: 0
Reviewed-by: Anders Heimer <anders.heimer@est.tech >
(From OE-Core rev: 2da74d75a8719db63979f132b456afdbd80395ef)
Signed-off-by: Daniel Turull <daniel.turull@ericsson.com >
(cherry picked from commit 5b52af4a02849c1ce74491056a2d13e4e3b6ad2d)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr >
Signed-off-by: Paul Barker <paul@pbarker.dev >
2026-07-20 09:04:31 +01:00
Daniel Turull
af5ab14071
libssh2: fix CVE-2026-55200
...
Backport patch to fix CVE-2026-55200.
https://nvd.nist.gov/vuln/detail/CVE-2026-55200
Upstream fix:
https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8
Tested with ptest:
Before: PASSED: 3, FAILED: 0, SKIPPED: 0
After: PASSED: 3, FAILED: 0, SKIPPED: 0
Reviewed-by: Anders Heimer <anders.heimer@est.tech >
(From OE-Core rev: a610461f9040644bec9f1b9be23dcfff121df888)
Signed-off-by: Daniel Turull <daniel.turull@ericsson.com >
(cherry picked from commit 42c8c6ec3066dc47b9eeeba0247ffa927193abff)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr >
Signed-off-by: Paul Barker <paul@pbarker.dev >
2026-07-20 09:04:31 +01:00
Hitendra Prajapati
f6b67fe3e8
libssh2: fix for CVE-2026-7598
...
Pick patch from [1] also mentioned at NVD report in [2]
[1] https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-7598
[3] https://security-tracker.debian.org/tracker/CVE-2026-7598
(From OE-Core rev: 84d6cca01c9d36ec112e5eb4104437f63ad2aee5)
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com >
Signed-off-by: Yoann Congal <yoann.congal@smile.fr >
Signed-off-by: Paul Barker <paul@pbarker.dev >
2026-06-10 14:35:20 +01:00
Vijay Anusuri
719a5fe1e3
libssh2: fix regression in KEX method validation (GH-1553)
...
Resolves: https://github.com/libssh2/libssh2/issues/1553
Regression caused by
https://github.com/libssh2/libssh2/commit/00e2a07e824db8798d94809156e9fb4e70a42f89
Backport fix
https://github.com/libssh2/libssh2/commit/4beed7245889ba149cc372f845d5969ce5103a5d
(From OE-Core rev: c348296ff0181921e8aa5a16d8d90db75f7b3e7c)
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com >
Signed-off-by: Steve Sakoman <steve@sakoman.com >
2025-12-17 08:48:38 -08:00
Vijay Anusuri
76d0c749da
libssh2: upgrade 1.11.0 -> 1.11.1
...
Changelog: https://github.com/libssh2/libssh2/releases/tag/libssh2-1.11.1
Dropped CVE-2023-48795.patch which is already included in version 1.11.1
Resolves: https://github.com/libssh2/libssh2/issues/1326
License-Update: Copyright symbols were changed from (C) to lowercase (c)
ptest results:
root@qemux86-64:~# ptest-runner libssh2
START: ptest-runner
2025-12-08T12:37
BEGIN: /usr/lib/libssh2/ptest
PASS: mansyntax.sh
PASS: test_simple
PASS: test_sshd.test
DURATION: 6
END: /usr/lib/libssh2/ptest
2025-12-08T12:37
STOP: ptest-runner
TOTAL: 1 FAIL: 0
(From OE-Core rev: 71316433eb018e831d72a873365aa53ed04f14f4)
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com >
Signed-off-by: Steve Sakoman <steve@sakoman.com >
2025-12-17 08:48:38 -08:00
Ross Burton
3adac25f89
libssh2: backport fix for CVE-2023-48795
...
Backport the upstream fix for CVE-2023-48795.
(From OE-Core rev: 314fa19c5e07fa632ff0434a6adbb97de1319a02)
Signed-off-by: Ross Burton <ross.burton@arm.com >
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org >
2024-01-24 15:46:19 +00:00
Sudip Mukherjee
be72174002
libssh2: disable rpath to fix curl-native build
...
When curl is built with PACKAGECONFIG:append = " libssh2", the build fails
with the error:
gcc: error: unrecognized command-line option '-R'
It was trying to set the rpath for libssh2.
(From OE-Core rev: c213d8579951e168a19231cf5b2f81d55e059a22)
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com >
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org >
2023-07-10 11:36:34 +01:00
Alexander Kanavin
681b43a6a7
libssh2: update 1.10.0 -> 1.11.0
...
License-update: copyright years
Enable static libs as some tests need them.
Fix up ptests; the set being run is the same.
test_simple is statically linked, hence DISABLE_STATIC is overriden.
(From OE-Core rev: c3c5b74e428a13335f8c09bf4cc74dd009c8bc06)
Signed-off-by: Alexander Kanavin <alex@linutronix.de >
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com >
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org >
2023-06-27 16:23:40 +01:00
Richard Purdie
57c38ab6d2
libssh2: Clean up ptest patch/coverage
...
Martin Jansa spotted patchreview.py reports Malformed Upstream-Status in a
patch in this recipe. The patch is not being applied since there is no ptest
override.
The test in question was also disabled due to an issue with new versions of
openssh.
Add a workaround for the broken test, enable it, drop the broken patch.
(From OE-Core rev: e9f2cc084638ce9cb5339df611e473c30f0e40b1)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org >
2023-02-17 18:01:01 +00:00
Alexander Kanavin
af067d427f
libssh2: skip one of the ptests until openssh 8.8 compatibility is fixed
...
(From OE-Core rev: 0a4275e61ec719247ddd1df5950ad570e8d3af02)
Signed-off-by: Alexander Kanavin <alex@linutronix.de >
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com >
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org >
2021-10-23 17:42:26 +01:00
Alexander Kanavin
0f89346baa
libssh2: update 1.9.0 -> 1.10.0
...
0001-configure-Conditionally-undefine-backend-m4-macro.patch no
longer needed; code removed upstream.
License-Update: copyright years
(From OE-Core rev: 6547e565cc1685eb4e42f61d88203cf743a06284)
Signed-off-by: Alexander Kanavin <alex@linutronix.de >
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org >
2021-10-11 18:41:38 +01:00
Khem Raj
550d0cee19
libssh2: Fix syntax for using ptest override
...
(From OE-Core rev: d2624e5581e55c43926099c3f7c00a632c6ff2e7)
Signed-off-by: Khem Raj <raj.khem@gmail.com >
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org >
2021-08-05 08:53:41 +01:00
Richard Purdie
bb6ddc3691
Convert to new override syntax
...
This is the result of automated script conversion:
scripts/contrib/convert-overrides.py <oe-core directory>
converting the metadata to use ":" as the override character instead of "_".
(From OE-Core rev: 42344347be29f0997cc2f7636d9603b1fe1875ae)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org >
2021-08-02 15:44:10 +01:00
Alexander Kanavin
3cdcc442c9
ptest: add newly discovered missing runtime dependencies across recipes
...
Making ptest images based on core-image-minimal uncovered quite a
few missing depenendcies from various recipes, here they are.
(From OE-Core rev: 2cda6242f2f0f6f9c6bdef72bbb271eab7e5e1f5)
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com >
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org >
2021-05-27 13:21:38 +01:00
Stefan Ghinea
01bd284339
libssh2: fix build failure with option no-ecdsa
...
libssh2 fails at do_compile if
DEPRECATED_CRYPTO_FLAGS = "no-ecdsa" is set in recipe:
../src/.libs/libssh2.so: undefined reference to
`LIBSSH2_KEX_METHOD_EC_SHA_HASH_CREATE_VERIFY'
References:
https://github.com/libssh2/libssh2/issues/549
Upstream patches:
https://github.com/libssh2/libssh2/commit/1f76151c92e1b52e9c24ebf06adc77fbd6c062bc
(From OE-Core rev: 2bb146e7315f8080cb49a95212231ccb76a4a822)
Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com >
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org >
2021-04-24 17:53:05 +01:00
Randy MacLeod
fcf428cdb5
libssh2: pull in additional commits from meta-oe
...
b24ef04ae libssh2: Fix build with autoconf 2.70+
d7aa71734 libssh2: enhance ptest
b3e9b51c9 libssh2: fix ptest
f5df715e2 libssh2: enable ptest
c1d1697c5 libssh2: add nativesdk support
3a6cbf246 libssh2: Security Advisory - libssh2 - CVE-2019-17498
40ea4c939 libssh2: upgrade 1.8.2 -> 1.9.0
5a7e65cbf libssh2: Clarify BSD license variant
(From OE-Core rev: 57df134b1be56a688f41851e5ff014dd859c0bc3)
Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com >
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org >
2021-02-26 15:21:20 +00:00
Randy MacLeod
53615dae3e
Add libgit2, libssh2 from meta-oe for rust
...
(From OE-Core rev: a6e49314f64b65b3a165d33ae581b6761ded0e82)
Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com >
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org >
2021-02-26 15:21:20 +00:00
Hetvi Thakar
Adarsh Jagadish Kamini
Jaipaul Cheernam
David Nyström
Daniel Turull
Hitendra Prajapati
Vijay Anusuri
Ross Burton
Sudip Mukherjee
Alexander Kanavin
Richard Purdie
Alexander Kanavin
Khem Raj
Stefan Ghinea
Randy MacLeod